Comarch ERP Optima Hard-Coded Database Credentials Vulnerability Allowing Elevated Privileges

A vulnerability exists in Comarch ERP Optima client versions prior to 2026.4, where a hard-coded password is used for a database user. These unchangeable credentials allow remote attackers to access the database with elevated privileges, including the ability to execute system commands on the server.

Impact

Exploitation of this vulnerability could lead to unauthorized database access with elevated privileges, allowing for the execution of system commands on the server.

Remediation

Users can upgrade to Comarch ERP Optima version 2026.4 or later to address this vulnerability.